VMware · Spring Framework
CVE-2022-22965
Spring Framework JDK 9+ Remote Code Execution Vulnerability
O que é
A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding. The specific exploit requires the application to run on Tomcat as a WAR deployment. If the application is deployed as a Spring Boot executable jar, i.e. the default, it is not vulnerable to the exploit. However, the nature of the vulnerability is more general, and there may be other ways to exploit it.
CISA: Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding.
O que fazer
Apply updates per vendor instructions.
Prazo para as agências federais dos EUA: 25 de abril de 2022
- Adicionada à lista da CISA
- 4 de abril de 2022
- Publicada
- 1 de abril de 2022
- Gravidade
- Crítica 9,8 CVSS 3.1
- Chance de ataques nos próximos 30 dias (EPSS)
- 99,6% entre os 0,1% mais altos de todas as vulnerabilidades conhecidas
- Fraqueza
- CWE-94
- Mais detalhes
- NVD · CVE.org · CISA
Todas as referências (8)
- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-java-spring-rce-Zx9GUc67
- https://tanzu.vmware.com/security/cve-2022-22965
- https://www.oracle.com/security-alerts/cpuapr2022.html
- https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2022-0005
- http://packetstormsecurity.com/files/166713/Spring4Shell-Code-Execution.html
- https://cert-portal.siemens.com/productcert/pdf/ssa-254054.pdf
- https://www.oracle.com/security-alerts/cpujul2022.html
- http://packetstormsecurity.com/files/167011/Spring4Shell-Spring-Framework-Class-Property-Remote-Code-Executio…
Mais falhas exploradas de VMware
| Adicionado | Vulnerabilidade | Produto | Gravidade | Chance de ataque |
|---|---|---|---|---|
| 4 de mar. de 2025 | TOCTOU Race Condition | ESXi and Workstation | Crítica 9,3 | 1,6% |
| 4 de mar. de 2025 | Arbitrary Write | ESXi | Alto 8,2 | 1,0% |
| 4 de mar. de 2025 | Information Disclosure | ESXi, Workstation, and Fusion | Alto 7,1 | 1,6% |
| 20 de nov. de 2024 | Heap-Based Buffer Overflow | vCenter Server | Crítica 9,8 | 55% |
| 20 de nov. de 2024 | Privilege Escalation | vCenter Server | Alto 7,5 | 17% |
| 30 de jul. de 2024 | Authentication Bypass | ESXi | Média 6,8 | 27% |
| 17 de jul. de 2024 | Incorrect Default File Permissions Vulnerability | vCenter Server | Média 6,5 | 13% |
| 22 de jan. de 2024 | Out-of-Bounds Write | vCenter Server | Crítica 9,8 | 99,2% |
Fontes: Known Exploited Vulnerabilities (CISA, domínio público), CVE records (cve.org) e EPSS (FIRST). A chance de ataque é a estimativa EPSS de que alguém tente explorar a falha nos próximos 30 dias.